PA 


Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240004-1 


Next 3 Page(s) In Document Exempt 


Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240004-1 


.Roproved For Relea 201081305 Gi ee 


7 * OFFICE OF MANAGEMENT AND BUDGET O NT 
a WASHINGTON, D.C. 20503 


mo 

Pe Od 

pes pas come 
Woe so! on o 


ray 
a fs 


MEMORANDUM FOR Agency apeiyaay Liaison Representatives 
Ad: Hoc Committee on P.L. 89-306. 
Interagency Committee on ADP 
Interagency Committee for Communications 
Federal ADP Council Chairman 


Subject: Supplemental OMB Guidelines for Implementing the 
Privacy Act of 1974 


Attached for your information is a copy of the Supplemental 
Privacy Act Guidelines which will be published in the 
Federal Register on Deeemeet ‘4, 1975 


TY fa eee 
Walter W. Haase 
Deputy Associate Director 
_£or- Information Systems 


Attachment 
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XECUTIVE OFFICE OF THE PRESIDENT . Eom 
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OFFICE OF MANAGEMENT AND BUDGET ¢* | 
WASHINGTON, D.C. 20503 


November 21, 1975 


‘TO THE HEADS OF EXECUTIVE DEPARTMENTS AND ESTABLISHMENTS 


SUBJECT: Supplementary Guidance on Implementing the Privacy _ 
: Act of 1974 


The attached material is provided to address comments and 
questions of general interest raised since the release of 
the Office of Management. and Budget's guidelines for 
implementing Section 3 of the Privacy Act of 1974. (Federal 
Register, Volume 40, Number 132, dated July 9, 1975, pp. 
28949-28978.) 


Additional supplements will be issued as necessary. 


5 Pe es ales 


SF Sn Bs oct es 
James T. Lynn 
Director 


Attachments 
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Privacy Act Guidelines ~- July 1, 1975 


(Federal Register, Vol. 40, No. 132, dated July 9, 1975 
pp. 28949-28978) 


1. Definition of System of Records (5° U.S.C. 552a(a) (5)). 
On page qe aer third column, after line 27, add: : 


"Following are several examples of the use of the term 
"system of records' 


"Telephone directories. Agency telephone directories are 
typically derived from files (e.g., locator cards) which 
are, themselves, systems of records. For example, agency 
personnel records may be used to ‘produce a_ telephone 
directory which is distributed to personnel of the agency 
and may be made available to the public pursuant to 5 U.S.C. 
552a(b) (1) and (2), (intra-agency and public disclosure, 
respectively). In this case the directory could be a 
disclosure from the system of records and, thus, would not 
be a separate system. On the other hand, a separate 
directory system would be a system of records if it contains 
personal information. A telephone directory, in this 
context, is a list of names, titles, . addresses, telephone 
numbers, and organizational designations. An agency should 
not utilize this distinction to avoid the requirements of 
the Act including the requirement to report the existence of 
systems of records which it maintains. 


"Mailing idee: Whether or not a mailing list is a avatar 
of records depends on whether the agency keeps the list as’a 
separate system. Mailing lists derived from records 


compiled for other purposes (e.g., licensing) could be 
considered disclosures from that system and would not be 
systems of records. If the system from which the list is 
produced is a system of records, the decision on the 
disclosability of the list would have to be made in terms of ' 
subsection (b) (conditions of disclosure) and subsection (n) 

(the sale or rental of mailing, lists). A mailing list may, 

in some instances, be a stand-alone system (é€.g., 

subscription lists) and could be a system of records subject 
to the Act if the list is maintained separately by the 
agency, it consists of records (i.e., contains personal 
information), and information is retrieved by reference to 
name or some other identifying particular. ; 


"Libraries. Standard bibliographic materials maintained in 
agency libraries such as library indexes, Who's Who volumes 
and similar materials are not considered to be systems: of 
records. This is not to suggest that all published material 
is, by virtue of that fact, not subject to the Act. 
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Collections of newspaper clippings or other published matter 
- about an individual maintained other than in a conventional 
reference library would normally be a system of records." 


‘2. Routine Uses - Intra-agency disclosures (5 U.S.C. 
552a (a) (7)) 


On page 28953, first column, after line 17, add: 


"Intra-agency transfer need not be considered’ routine uses. 
Earlier versions of House privacy bills, from which the 
routine use concept derives, permitted agencies to disclose 
records within the agency to personnel who had a need for 
such access in the course*.of their official duties thus 
permitting intra-agency disclosure without the consent of 
the individual. The concept of routine use was developed to 
permit other than intra-agency disclosures after it became 
apparent that a substantial unnecessary workload would 
result from having to seek the consent of the subject of a 
record each time a transfer was made for a purpose 
',..compatible with the purpose for which [the record] was 
collected' (5 U.S.C. 552a(a)(7)). To deter promiscuous use 
of this concept, a further provision was added requiring 
imal couline uSes be Subject tuo public noecice. (8. VRS. 
552a(e)(11).) It is our view that the concept cf routine use 
was devised to cover disclosures other than those to 
officers or employees who have a need to for the record in 
the performance of their official duties within the agency. 


"It is not necessary, therefore, to include intra-agency 
transfers in the portion of the system notice covering 
routine uses (5 U.S.C. 552a(e) (4) (D)) but agencies may, at 
their option, elect to do so. The portion of the system 
notice covering storage, retrievability, access controls, 
retention and dQisposal (5 U.S.C. 552a(e) (4) (E)) should 
‘describe the categories of agency officials who have access 
to the system." 


3. Consent for access in response to congressional 


inquiries (5 U.S.c. 552a(b) (9) ) 
On page 28955, third column, after line 18, add: 


To assure that implementation of the Act does not have the 
unintended effect of denying individuals the benefit of 
congressional assistance which they request, it is 
recommended that each agency establish the following as a 
routine use for all of its systems, consistent with 
subsections (a) (7) and (e) (11) of the Act: 
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Disclosure may be made to a congressional office 
from the record of an individual in response to an 
inquiry from the congressional office made at the 
request of that individual. , 


The operation of this routine use will obviate the need for 
the written consent of the individual in every case where an 
individual requests assistance of the Member which would 
entail a disclosure of information pertaining to the 
individual. 


In those cases where the congressional inquiry indicates 
that the request is being made on behalf of a person other 
than the individual whose record is ‘to be disclosed, the 
agency should advise the congressional office that the 
written consent of the subject of the record is required. 
The agency should not contact the subject unless’ the 
congressional office requests it to do so. 


- In addition to the routine use, agencies can, of course, 
respond to many congressional requests for assistance on 
behalf of individuals. without disclosing personal 
information which would fall within the Privacy Act, e.g., a 
congressional inquiry concerning a missing Social Security 
eneck can be answered by the agency by stating the reasen 
for the delay. ‘ 


Personal information can be disclosed in response to a 
congressional inquiry without written consent or operation 
of a routine use-- 


~- if the information would be required to be disclosed 
under the Freedom of Information Act (Subsection (b) (2)); 


== if the Member requests that the response go directly 
to the individual to whom the record pertains; 


-- in “compelling circumstances affecting the health or 
safety of an individual..." (Subsection (b) (8)); or 


-- to either House of Congress, or to the extent of 
matter within its jurisdiction, any committee or 
subcommittee thereof..." (Subsection (b) (9)). 


The routine use recommended above and disclosures thereunder 
are, of course, subject to the 30 day prior notice 
requirement of the Act (Subsection (e)(11)). In the 
interim, however, it should be possible to respond to most 
inguiries by using the provisions cited in the previous 
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paragraph. Furthermore, when the congressional inquiry 
indicates that the request is being made on the basis of a 
‘written request from the individual to whom the record 
pertains, consent can be inferred even if the constituent 
jletter is not provided to the agency. 


"This standard for implied consent does not appl to other 
ee Se Ne Ae ee eee pes goes moe appty fo other 
than congressional inquiries." 


4, Describing the purpose in the accounting of disclosures 
(Subsection (c) {(T)) 


On page 28956, first column, after line 42, add: 
: . 

“Agencies which submit inquiries to other agencies in 
connection with law enforcement or pre-employment 
investigations (e.g., record checks) are reminded to include 
the purpose in their record check in order to preclude 
having record checks returned to them to ascertain the 
purpose of the check. It is noted that this is necessary 
whether the inquiry is made pursuant to the subsection 


(b) (3) or (b) (7) (‘routine use' or law enforcement 
disclosures). At a minimum, the inquiring agency must 
dascrihe the purnnes ag either 3a background or lav 


enforcement check," 


+ 


5. Agency procedures for review of appeals of denials of 
requests to amend a record (Subsection (d)(3)) 


On page 28959, second column, after line 39, add: 


"This does not mean that the officer on appeal must be a 
justice or judge. Rather, the reviewing official designated 
by the agency head may be a justice or judge (unlikely in 
this case) or any other agency official who meets the 
criteria in 5 U.S.C. 2104a(1), (2), and (3)." 


6. Correcting records released to an individual (Subsection 
(e) (6 ; 


On page 28965, second column, after line 6, add: 


"While this language requires that agencies make reasonable 
efforts to assure the accuracy of a record before it is 
disclosed, when an individual requests access to his or her 
record, pursuant to subsection (d)(1), above, the record 
must be disclosed without change or deletion except as 
permitted by subsections (j) and (k), exemptions. To avoid 
requiring individuals to file unnecessary requests for 
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amendment, however, the agency should review the record and 
annotate any material disclosed to indicate that. which it 
intends to amend or delete," : 


7. Rights of parents and iegal guardians (Subsection (h))° 
On page 28970, second column, after line 59, add: . 


"This is not intended to suggest that minors are precluded 
from exercising rights on their own behalf. Except as 
otherwise provided in the Act (e.g., general or specific 
exemptions) a minor does have the right to access a record 
pertaining to him or herself. There -is no absolute right of 
a parent to have access to a record about a child absent a 
court order or consent." 


8. Relationships to the Freedom of Information Act 
(Subsection (q)) 


“On page 28978, third column, after the last line, add: 


"In some instances under the Privacy Act an agency may (1) 
exempt a system of records. (or a portion thereof) from 
access by indiviauals Gn accosdauce with ihe general or 
_ Specific exemptions (subsection (j) or .(k)); or (2) deny a 
request for access to records compiled in reasonable 
anticipation of a civil action or proceeding or archival 
records (subsection (d)(5) or (1)). In a few instances the 
exemptions from disclosure under the Privacy Act may be 
interpreted to be broader than the Freedom of Information 
Act (5 U.S.C. 552). In such instances the Privacy Act 
Should not be used to deny access to information about an 
individual which would otherwise have been required to be 
disclosed to that individual under fhe Fréedom of 
Information Act. ; 


"Whether a request by an individual for access to his or her 
‘record is to be processed under Privacy Act or Freedom of 
Information Act procedures involves several considerations. 
For example, while agencies have been encouraged to reply to 
requests for access under the Privacy Act within ten days 
wherever practicable, consistent with the Freedom of 
Information Act (FOIA), the Privacy Act does not establish 
time limits for responding to requests for access. (See 
discussion of subsection (d)(1).) The Privacy Act also does 
not require an administrative appeal on denial of access 
comparable to that under FOIA although agencies are 
encouraged to permit individuals to request an 
administrative review of initial denials of access to avoid, 
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where possible, the need for unnecessary judicial action. 
It can also be argued that requests filed under the Privacy 
Act can be expected to be specific as to the system of 
records to which access is sought whereas agencies are 
required to respond to an FOIA request only if Lt. 
“reasonably describes" the records sought. Further, the 
Freedom of Information Act permits charging of fees for 
search as well as the making of copies while the Privacy Act 
permits charging only for the direct cost of making a copy 
upon request. 


"Tt is our view that agencies should treat requests by 
individuals for information pertaining to themselves which 
specify either the FOIA or the Privacy Act (but not both) 
under the procedures established pursuant to the Act 
specified in the request. When the request specifies, and 
may be processed under, both the FOIA and the Privacy Act, 
or specifies neither Act, Privacy Act procedures should be 
employed. The individual should be advised, however, that 
the agency has elected to use Privacy Act procedures, of the 
existence and the general effect of the Freedom of 
Information Act, and of the differences, if any, between the 
agency's procedures under the two Acts (e.g., fees, time 


Timite annaca and annaale\ 
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"The net effect of this approach should be to assure the 
individuals do not, as a consequence of the Privacy Act, 
have less access to information pertaining to themselves 
than they had prior to its enactment." 
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